JP2004265322A - Abnormality monitoring device for microcomputer - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a microcomputer abnormality monitoring device for monitoring not only the unexpected abnormal operation of a microcomputer but also repeated abnormal operation. <P>SOLUTION: The microcomputer abnormality monitoring device 25 comprises an operation monitoring part 30 for monitoring the operation state of the microcomputer 20 for outputting control signals to apparatuses 13L, 13R, an abnormality frequency counting part 33 for counting the frequency of an abnormality in the microcomputer 20 on the basis of an output from the monitoring part 30, an abnormality frequency determination part 35 for comparing the counted frequency with a previously set reference frequency, and a reset holding signal generation part 40 for holding a reset signal of the microcomputer 20 when the abnormality frequency determination part 35 determines that the counted abnormality frequency is a reference frequency and higher. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an abnormality monitoring device that monitors an abnormal operation of a microcomputer.
[0002]
[Prior art]
Microcomputers control built-in devices in vehicles and home appliances. For example, in an air bag system of a vehicle, a collision is detected by a G sensor, and a microcomputer operates a driving device based on the collision to deploy the air bag.
[0003]
The microcomputer may operate abnormally (runaway) due to a defect in the CPU program or the like. When an abnormal operation occurs, the built-in device does not operate at a predetermined time or operates at a time other than the predetermined time. In the case of an airbag device, it is extremely dangerous if the airbag is suddenly expanded during driving of the vehicle or if the airbag is not expanded at the time of collision.
[0004]
In consideration of these points, the conventional CPU operation monitoring method (see Patent Document 1) includes an operation monitoring circuit 102 for monitoring the operation of the CPU 100 and a reset circuit 104 for resetting the CPU 100, as shown in FIG. I have. During a normal operation, the CPU 100 periodically outputs a normal operation signal to the operation monitoring circuit 102.
[0005]
When an abnormality occurs in the CPU 100, a normal operation signal is not generated, and the operation monitoring circuit 102 outputs a request signal to the reset circuit 104. Based on this, the reset circuit 104 outputs a reset signal to the CPU 100 to reset.
[0006]
[Patent Document 1]
JP-A-9-212388
[Problems to be solved by the invention]
It is difficult to say that this operation monitoring method can reliably monitor an abnormal operation of the CPU 100. The operation monitoring circuit 102 determines an abnormality of the CPU 100, transmits an abnormality determination signal to the reset circuit 104, and the reset circuit 104 transmits a reset signal to the CPU 100. However, a time delay inevitably occurs until the CPU 100 actually performs the reset, and during this delay time, the CPU 100 is in an abnormal state.
[0008]
When the reset is repeated, there is a period of this abnormal state for the number of repetitions, so that the possibility that the system malfunctions increases. In the case of an airbag system, the airbag may suddenly deploy during normal operation, or the airbag may not deploy when a vehicle collides.
[0009]
The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a microcomputer abnormality monitoring device that can cope with repetitive abnormal operations that occur repeatedly.
[0010]
[Means for Solving the Problems]
The inventor of the present application completed the present invention by thinking that the reset signal is held when the number of abnormal operations of the microcomputer (the number of abnormal operations) occurs more than a predetermined reference number.
[0011]
An abnormality monitoring device for a microcomputer according to the present invention monitors a microcomputer that outputs a control signal to a device as described in claim 1, and monitors an occurrence of an abnormal operation; based on an output of the operation monitoring unit, An abnormal number counting unit for counting the number of abnormalities of the microcomputer; an abnormal number determining unit for comparing the counted number of abnormalities with a preset reference number; an abnormal number exceeding the standard number based on the output of the abnormal number determining unit And a reset holding signal generating section for holding a reset signal to the microcomputer.
[0012]
In this abnormality monitoring device, the number of abnormalities is counted by the abnormal number counting unit based on the output from the operation monitoring unit that monitors the microcomputer, and when the abnormal number determination unit determines that the abnormal number exceeds the reference number, a reset holding signal is generated. The unit holds a reset signal to the microcomputer.
[0013]
According to a second aspect of the present invention, in the first aspect of the present invention, the operation monitoring unit includes a microcomputer which receives a signal indicating an abnormality output from the microcomputer, or when the signal output from the microcomputer cannot be received normally. Judge as abnormal. According to a third aspect of the present invention, in the abnormality monitoring device according to the first aspect, the abnormality number counting unit counts the number of abnormality determinations input from the operation monitoring unit.
[0014]
According to a fourth aspect of the present invention, in the first aspect, the abnormality number determination unit includes a comparison unit configured to compare the abnormality number input from the abnormality number counting unit with a set reference number. According to a fifth aspect of the present invention, in the second aspect, the microcomputer is a microcomputer of an airbag ECU that controls an airbag device of the vehicle, and the device is an airbag driving device of the vehicle.
[0015]
BEST MODE FOR CARRYING OUT THE INVENTION
<Microcomputer>
The abnormality monitoring device of the present invention monitors a control microcomputer. The microcomputer has a watchdog (WD) signal generation unit and the like in addition to the calculation unit, and controls devices built in the vehicle or the home electric appliance. For example, an airbag driving device of a vehicle corresponds to this.
<Abnormality monitoring device>
The abnormality monitoring device according to the present invention includes an operation monitoring unit, an abnormality number counting unit, an abnormality number determination unit, and a reset generation unit.
(1) Operation monitoring unit The operation monitoring unit monitors the occurrence of abnormal operation in the microcomputer. It comprises an input unit for receiving a WD signal from a microcomputer, and an operation determining unit for determining a pulse shape and detecting an abnormality. When a signal indicating an abnormality output from the microcomputer is received, or when a signal output from the microcomputer cannot be received normally, it is determined that the microcomputer is abnormal.
(2) Abnormal frequency counting section The abnormal frequency counting section is for counting the number of abnormal times of the microcomputer. The microcomputer comprises an input unit to which a microcomputer abnormality signal is input from a copper prosperity branch, and a counting unit for counting the number of abnormalities of the microcomputer.
{Circle around (3)} Number of abnormalities determination unit The number of abnormalities determination unit determines whether the number of abnormalities of the microcomputer exceeds a reference number. It comprises an input section for inputting a signal relating to the number of abnormalities from the abnormal number counting section, a comparing section for comparing the inputted number of abnormalities with a preset reference number, and an output section for outputting a comparison result to the reset generating section.
[0016]
Note that the reference number is determined for each system in consideration of the degree of safety design required for the system or circuit.
{Circle around (4)} Reset hold signal generator The reset hold signal generator holds the microcomputer in a reset state (a state in which the system does not operate). The input unit receives a signal related to the comparison of the number of times from the abnormality number determination unit, a signal generation unit that generates a reset signal when the number of abnormalities is greater than the reference number, and an output unit that outputs a reset holding signal to the microcomputer.
[0017]
【Example】
Hereinafter, an embodiment in which the present invention is applied to an airbag system of a vehicle will be described with reference to the accompanying drawings.
(Constitution)
FIG. 1 shows an airbag system of a vehicle. A front left airbag 12L and its driving device 13L are arranged in front of the left seat 10L, and a front right airbag 12R and its driving device 13R are arranged in front of the right seat 10R. An ECU 15 containing a G sensor 17 and a microcomputer 20 is disposed in the center of the vehicle.
[0018]
For example, when the front of the vehicle collides with a guardrail or the like, the G sensor 17 of the ECU 15 detects a rapid change in acceleration, and the left front and right front driving devices 13L and 13R operate according to an operation signal from the microcomputer 20, and The front and right front airbags 12L and 12R are deployed.
[0019]
FIG. 2 shows the microcomputer 20 and an abnormality monitoring device 25 for monitoring its abnormal operation. The microcomputer 20 includes an arithmetic unit 21, a RAM, a ROM, an I / O unit (not shown), a WD signal P generation unit 22, and the like. As shown in FIG. 3A, the WD signal P is a signal having a fixed cycle when the operation of the microcomputer 20 is normal, and it is determined that the WD signal is abnormal when the WD signal is out of this cycle. The arithmetic unit 21 returns to the initial state when reset by a reset generation unit 40 described later, and releases the reset signal when the WD signal returns to normal, thereby returning the operation of the system.
[0020]
The abnormality monitoring device 25 includes an operation monitoring unit 30, an abnormality number counting unit 33, an abnormality number determination unit 35, and a reset generation unit 40. The operation monitoring unit 30 includes an input unit, a determination unit 31 that determines a periodic signal of the WD signal P, and an output unit. The abnormality number counting unit 33 includes an input unit, a counting unit (counter) 34 that counts the number of abnormalities of the microcomputer 20, and an output unit.
[0021]
The abnormality number determination unit 35 includes an input unit, a comparison unit 36 that compares the abnormality number of the microcomputer 20 from the abnormality number counting unit 33 with a preset reference number, and an output unit. The reset holding signal generating section 40 includes an input section, a signal generating section 41 for generating a reset holding signal, and an output section.
(Action)
The monitoring of the abnormal operation of the microcomputer 20 by the abnormality monitoring device 25 will be described with reference to FIGS. When the ignition key is turned on, the microcomputer 20 operates by power supply from the battery. When the collision of the vehicle is detected by the G sensor 17, the microcomputer 20 operates the driving devices 13L and 13R, whereby the airbags 12L and 12R are deployed.
[0022]
When an abnormal operation occurs in the microcomputer 20, the abnormality detection of the operation monitoring unit 30 is slightly delayed from the occurrence of the abnormality of the arithmetic unit 21, as shown in FIG.
[0023]
When the operation monitoring unit 30 is notified of the abnormal operation of the microcomputer 20, the determination unit 31 determines the abnormality of the periodic signal of the pulse Q. The abnormality number measurement unit 33 determines that the counting unit 34 uses the microcomputer based on the signal from the operation monitoring unit 30. The number of occurrences (abnormal times) of the 20 abnormal operations is counted. The counting result is output from the output unit to the abnormal number determination unit 35.
[0024]
The number-of-abnormalities determination unit 35 compares the input number of abnormalities with a reference number preset in the comparing unit 36. The comparison result is output from the output unit to the reset holding signal generation unit 40.
[0025]
In the reset generation unit 40, the signal generation unit 41 generates the pulse-shaped reset signal R1 while the number of abnormalities input from the abnormal number of times determination unit 35 is smaller than the reference number. When the WD signal returns to normal, the reset signal R1 releases the reset signal to return the system to the normal state, and the control of the driving devices 13L and 13R by the microcomputer 20 is restored.
[0026]
Note that the microcomputer 20 operates abnormally during the time Δt from the occurrence of the abnormality of the microcomputer 20 to the generation of the reset signal R1. Hereinafter, even if an abnormal operation of the microcomputer 20 occurs, the above-described sequence is repeated until the number of abnormalities reaches the reference number.
[0027]
When the abnormality number determination unit 35 determines that the abnormality number exceeds the reference number, the signal generation unit 41 of the reset generation unit 40 generates the reset holding signal R2. With the reset holding signal R2, the reset state is held even if the WD signal returns to normal.
In this case, the control of the driving devices 13L and 13R by the microcomputer 20 becomes impossible, so that the occupant is notified of the failure of the airbag system (the microcomputer 20) by a warning lamp or the like.
(effect)
According to this embodiment, the repetitive abnormal operation of the microcomputer 20 is reliably monitored. More specifically, even if a sudden abnormal operation occurs in the microcomputer 20, the abnormality monitoring device 25 only outputs the reset signal R1 from the reset generation unit 40. Then, after the microcomputer 20 returns to the normal state, the reset signal is released to return the system. That is, in order to minimize the time during which the microcomputer 20 operates abnormally, the abnormality of the microcomputer 20 is detected and reset as soon as possible.
[0028]
On the other hand, when the microcomputer abnormality repeatedly occurs, the reset is held and the operation of the microcomputer 20 is stopped. When a repetitive abnormal operation occurs, the abnormality monitoring device 25 determines that a serious abnormal operation (failure) has occurred in the system. It is not permissible to leave such a state for the protection of the occupants. Therefore, the reset signal R2 is output from the reset generator 40 to reset the microcomputer 20.
[0029]
The occupant who knows the failure of the airbag system including the ECU 21 can take necessary measures (repair, replacement of parts, etc.).
[0030]
As a comparative example, the microcomputer may be reset based on the duration of the microcomputer abnormality. The duration of the PC abnormality is measured by a timer or the like, and the microcomputer resets the microcomputer by the reset unit when the abnormality time determination unit determines that the duration exceeds the reference time. However, this is a method of changing the reset on / off depending on the duration of the microcomputer abnormal time, and is unstable as a system.
[0031]
【The invention's effect】
As described above, according to the microcomputer abnormality monitoring device of the present invention, when the abnormality count of the microcomputer exceeds the reference number, the reset signal is held, the microcomputer stops operating, and the system stops operating. . Therefore, improper operation of the device due to abnormal operation of the microcomputer is prevented.
[0032]
On the other hand, while the number of abnormalities is smaller than the reference number, after the microcomputer is reset, the reset signal is released when normality is restored, and the operation of the system is restored.
[0033]
According to the abnormality monitoring device of the second aspect, the determination means of the operation monitoring unit can reliably detect the abnormal operation of the microcomputer. According to the abnormality monitoring device of the third aspect, the counting means of the abnormality number counting section can accurately count the number of abnormalities of the microcomputer.
[0034]
According to the abnormality monitoring device of the fourth aspect, the comparison means of the abnormality number determination unit can accurately compare the abnormality number with the reference number. According to the abnormality monitoring device of the fifth aspect, the abnormal operation of the microcomputer in the airbag system of the vehicle is reliably monitored.
[Brief description of the drawings]
FIG. 1 is an overall plan view showing an embodiment of the present invention.
FIG. 2 is an explanatory diagram illustrating an abnormality monitoring device according to an embodiment.
FIG. 3 is an explanatory diagram showing signals in a microcomputer, an operation monitoring unit, and a reset generation unit of the embodiment.
FIG. 4 is an explanatory diagram of a conventional example.
[Explanation of symbols]
10L, 10R: Seat 12L, 12R: Airbag 13L, 13R: Drive 15: ECU
17: G sensor 20: Microcomputer 25: Abnormal operation monitoring device 30: Operation monitoring unit 35: Abnormal frequency judgment unit 40: Reset generation unit

Claims (5)

An operation monitoring unit that monitors a microcomputer that outputs a control signal to the device and monitors occurrence of abnormal operation;
Based on the output of the operation monitoring unit, an abnormal number counting unit that counts the number of abnormalities of the microcomputer,
An abnormality number determination unit that compares the counted number of abnormalities with a preset reference number,
A reset holding signal generation unit that holds a reset signal to the microcomputer when the number of abnormalities exceeds a reference number, based on an output of the abnormal number determining unit,
An abnormality monitoring device for a microcomputer, comprising: The abnormality monitoring device according to claim 1, wherein the operation monitoring unit determines that the microcomputer is abnormal when receiving a signal indicating an abnormality output from the microcomputer or when a signal output from the microcomputer cannot be normally received. apparatus. The abnormality monitoring device according to claim 1, wherein the abnormality number counting unit counts the number of abnormality determinations input from the operation monitoring unit. 2. The abnormality monitoring device according to claim 1, wherein the abnormality number determination unit includes a comparison unit configured to compare the number of abnormalities input from the abnormality number counting unit with a set reference number. The abnormality monitoring device according to claim 2, wherein the microcomputer is a microcomputer of an airbag ECU that controls an airbag device of the vehicle, and the device is an airbag driving device of the vehicle.

Images